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Remarks 

Claims 1-23 remain in the application. Claims 1, 7, 14, 17, 20 and 21 are 
hereby amended. No new matter is being added. 



Claim Rejections 

Original claims 1-23 were rejected under 35 USC 102 and/or 103(a) as 
being anticipated by Amara et al (USP 6,839,338) or as being unpatentable over 
Amara et al in combination with one or more other references (including Liu et al, 
Kojima et al, Classon et al, and Engwer). Applicants respectfully traverse these 
rejections in relation to the claims as hereby amended. 

Amended claim 1 now recites as follows. 

1 . A method for secure remote mirroring of network traffic, the method 
comprising: 

receiving a data packet to be remotely mirrored by an entry device pre- 
configured with a destination address to which to mirror the data 
packet; 

encrypting the data packet to form an encrypted packet; 

incrementing an identifier for indicating a position of the data packet within 

an order of packets received by the entry device for remote mirroring; 
generating and adding a header to encapsulate the encrypted data packet, 

wherein the header includes the destination address and said 

identifier ; and 

forwarding the encapsulated encrypted packet to an exit device associated 
with the destination address. 

(Insertions indicated by underline.) 

As seen above, amended claim 1 now recites limitations which are specific to a 
remote mirroring application. 

In particular, claim 1 now requires "incrementing an identifier for indicating 
a position of the data packet within an order of packets received by the entry 
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device for remote mirroring." In addition, claim 1 now requires that said identifier 
is included in the encapsulating header. 

The use of this incrementing identifier is explained in the present 
application, for example, on page 8, lines 6-1 1 , which recites as follows. 

... In one implementation, an incrementing identifier is included in the generated 
IP header. This identifier may be used to determine whether mirrored packets 
arrive at the exit point in order and without drops. In addition, the identifier may 
be used to re-order the mirrored packets so that a sniffer or analyzer connected to 
the exit device can see the packets in the order they were received at the entry 
point. 

As explained above, the incrementing identifier may be used to re-order the 
mirrored packets at the exit device. This enables a sniffer or analyzer connected 
to the exit device to view the mirrored packets in order so that, for example, 
virus-like behavior or other problems or situations may be detected. 

Amara et al does not pertain to remote mirroring of traffic between an 
entry device and an exit device. Instead, Amara et al relates to using IP security 
so that a mobile node may communicate securely to its home network. 

Because Amara et al does not pertain to remote mirroring, Amara et al 
does not need the claimed incrementing identifier for indicating a position of 
each mirrored packet within an order of the mirrored packets. Therefore, 
applicants respectfully submit that Amara et al does not disclose or teach the 
method of amended claim 1. 

The other cited references also do not appear to disclose or teach the 
added limitations relating to the incrementing identifier which enables re-ordering 
of the mirrored packets. For example, Liu et al pertains generally to an "Ethernet 
Architecture with Data Packet Encapsulation" and does not relate to the 
particular application of remote mirroring. Similarly, Kojima et al, Classon et al, 
and Engwer also do not relate to the particular application of remote mirroring. 

Therefore, applicants respectfully submit that claim 1, as hereby amended, 
now overcomes these rejections for at least the above-discussed reasons. 
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Claims 2-13 depend from claim 1. Hence, applicants respectfully submit 
that these claims now also overcome these rejections for at least the same 
reasons discussed above in relation to claim 1 . 

Claim 14 is amended with similar limitations as claim 1. Hence, 
applicants respectfully submit that claim 14 now overcomes these rejections for 
at least the same reasons discussed above in relation to claim 1. 

Claims 15-16 depend from claim 14. Hence, applicants respectfully 
submit that these claims now also overcome these rejections for at least the 
same reasons discussed above in relation to claim 14. 

Claim 17 is also amended with similar limitations as claim 1. Hence, 
applicants respectfully submit that claim 17 now overcomes these rejections for 
at least the same reasons discussed above in relation to claim 1 . 

Claims 18-19 depend from claim 17. Hence, applicants respectfully 
submit that these claims now also overcome these rejections for at least the 
same reasons discussed above in relation to claim 17. 

Claim 20 is also amended with similar limitations as claim 1. Hence, 
applicants respectfully submit that claim 20 now overcomes these rejections for 
at least the same reasons discussed above in relation to claim 1. 

Claim 21 is also amended with similar limitations as claim 1. Hence, 
applicants respectfully submit that claim 21 now overcomes these rejections for 
at least the same reasons discussed above in relation to claim 1. 

Claims 22-23 depend from claim 21. Hence, applicants respectfully 
submit that these claims now also overcome these rejections for at least the 
same reasons discussed above in relation to claim 21. 
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Conclusion 

For the above-discussed reasons, applicant believes that the pending 
claims, as they are hereby amended, now overcome the claim rejections. 
Favorable action is respectfully requested. 

If for any reason an insufficient fee has been paid, the Commissioner is 
hereby authorized to charge the insufficiency to Deposit Account No. 08-2025. 



Respectfully Submitted, 
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Dated: July 26. 2007 M U . 
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